CVE-2024-3591

MEDIUM

WordPress Geo Controller < 8.6.5 - PHP Object Injection

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2024-3591 has a selected CVSS score of 6.5 (medium).

Description

The Geo Controller WordPress plugin before 8.6.5 unserializes user input via some of its AJAX actions and REST API routes, which could allow unauthenticated users to perform PHP Object Injection when a suitable gadget is present on the blog.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationPoC
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated May 1, 2024 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

Geo Controller

Default status: unaffected

CVE ListBefore 8.6.5affected

geo_controller

Browse wordpress / geo_controller

Default status: unknown

CVE List- to < 8.6.5affected

References

2